Configuring the Component Keyring in Percona Server and PXC 8.4
(Or: how to make MySQL encryption boring, which is the goal)
Encryption is one of those things everyone agrees is important, right up until MySQL refuses to start and you’re staring at a JSON file wondering which brace ruined your evening.
With MySQL 8.4, encryption has firmly moved into
the component world, and if you’re running
Percona Server 8.4 or Percona XtraDB
Cluster (PXC) 8.4, the supported path forward is the
component_keyring_file component.
The good news: the setup is mostly identical for Percona Server
and PXC.
The bad news: PXC 8.4.4 and 8.4.5 shipped with a bug that makes
this less fun than it should be.
Let’s walk through a setup that works, keeps your keys locked down, and avoids the usual landmines.
Step 1: Tell …
[Read more]